kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-28 20:03:05 +00:00
Code Issues Releases Packages Activity
linux/drivers/dma
History
Fenghua Yu 5e3022ea42 dmaengine: idxd: Ensure safe user copy of completion record 
[ Upstream commit d3ea125df3 ]

If CONFIG_HARDENED_USERCOPY is enabled, copying completion record from
event log cache to user triggers a kernel bug.

[ 1987.159822] usercopy: Kernel memory exposure attempt detected from SLUB object 'dsa0' (offset 74, size 31)!
[ 1987.170845] ------------[ cut here ]------------
[ 1987.176086] kernel BUG at mm/usercopy.c:102!
[ 1987.180946] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
[ 1987.186866] CPU: 17 PID: 528 Comm: kworker/17:1 Not tainted 6.8.0-rc2+ #5
[ 1987.194537] Hardware name: Intel Corporation AvenueCity/AvenueCity, BIOS BHSDCRB1.86B.2492.D03.2307181620 07/18/2023
[ 1987.206405] Workqueue: wq0.0 idxd_evl_fault_work [idxd]
[ 1987.212338] RIP: 0010:usercopy_abort+0x72/0x90
[ 1987.217381] Code: 58 65 9c 50 48 c7 c2 17 85 61 9c 57 48 c7 c7 98 fd 6b 9c 48 0f 44 d6 48 c7 c6 b3 08 62 9c 4c 89 d1 49 0f 44 f3 e8 1e 2e d5 ff <0f> 0b 49 c7 c1 9e 42 61 9c 4c 89 cf 4d 89 c8 eb a9 66 66 2e 0f 1f
[ 1987.238505] RSP: 0018:ff62f5cf20607d60 EFLAGS: 00010246
[ 1987.244423] RAX: 000000000000005f RBX: 000000000000001f RCX: 0000000000000000
[ 1987.252480] RDX: 0000000000000000 RSI: ffffffff9c61429e RDI: 00000000ffffffff
[ 1987.260538] RBP: ff62f5cf20607d78 R08: ff2a6a89ef3fffe8 R09: 00000000fffeffff
[ 1987.268595] R10: ff2a6a89eed00000 R11: 0000000000000003 R12: ff2a66934849c89a
[ 1987.276652] R13: 0000000000000001 R14: ff2a66934849c8b9 R15: ff2a66934849c899
[ 1987.284710] FS:  0000000000000000(0000) GS:ff2a66b22fe40000(0000) knlGS:0000000000000000
[ 1987.293850] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1987.300355] CR2: 00007fe291a37000 CR3: 000000010fbd4005 CR4: 0000000000f71ef0
[ 1987.308413] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 1987.316470] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400
[ 1987.324527] PKRU: 55555554
[ 1987.327622] Call Trace:
[ 1987.330424]  <TASK>
[ 1987.332826]  ? show_regs+0x6e/0x80
[ 1987.336703]  ? die+0x3c/0xa0
[ 1987.339988]  ? do_trap+0xd4/0xf0
[ 1987.343662]  ? do_error_trap+0x75/0xa0
[ 1987.347922]  ? usercopy_abort+0x72/0x90
[ 1987.352277]  ? exc_invalid_op+0x57/0x80
[ 1987.356634]  ? usercopy_abort+0x72/0x90
[ 1987.360988]  ? asm_exc_invalid_op+0x1f/0x30
[ 1987.365734]  ? usercopy_abort+0x72/0x90
[ 1987.370088]  __check_heap_object+0xb7/0xd0
[ 1987.374739]  __check_object_size+0x175/0x2d0
[ 1987.379588]  idxd_copy_cr+0xa9/0x130 [idxd]
[ 1987.384341]  idxd_evl_fault_work+0x127/0x390 [idxd]
[ 1987.389878]  process_one_work+0x13e/0x300
[ 1987.394435]  ? __pfx_worker_thread+0x10/0x10
[ 1987.399284]  worker_thread+0x2f7/0x420
[ 1987.403544]  ? _raw_spin_unlock_irqrestore+0x2b/0x50
[ 1987.409171]  ? __pfx_worker_thread+0x10/0x10
[ 1987.414019]  kthread+0x107/0x140
[ 1987.417693]  ? __pfx_kthread+0x10/0x10
[ 1987.421954]  ret_from_fork+0x3d/0x60
[ 1987.426019]  ? __pfx_kthread+0x10/0x10
[ 1987.430281]  ret_from_fork_asm+0x1b/0x30
[ 1987.434744]  </TASK>

The issue arises because event log cache is created using
kmem_cache_create() which is not suitable for user copy.

Fix the issue by creating event log cache with
kmem_cache_create_usercopy(), ensuring safe user copy.

Fixes: c2f156bf16 ("dmaengine: idxd: create kmem cache for event log fault items")
Reported-by: Tony Zhu <tony.zhu@intel.com>
Tested-by: Tony Zhu <tony.zhu@intel.com>
Signed-off-by: Fenghua Yu <fenghua.yu@intel.com>
Reviewed-by: Lijun Pan <lijun.pan@intel.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Link: https://lore.kernel.org/r/20240209191412.1050270-1-fenghua.yu@intel.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2024-03-06 14:48:43 +00:00
..
bestcomm dmaengine: Explicitly include correct DT includes 2023-08-01 23:51:27 +05:30
dw dmaengine: Explicitly include correct DT includes 2023-08-01 23:51:27 +05:30
dw-axi-dmac dmaengine: Explicitly include correct DT includes 2023-08-01 23:51:27 +05:30
dw-edma dmaengine: dw-edma: eDMA: Add sync read before starting the DMA transfer in remote setup 2024-03-06 14:48:43 +00:00
fsl-dpaa2-qdma dmaengine: fsl-dpaa2-qdma: Fix the size of dma pools 2024-02-16 19:10:42 +01:00
hsu dmaengine: hsu: Include headers we are direct user of 2022-09-04 22:49:35 +05:30
idxd dmaengine: idxd: Ensure safe user copy of completion record 2024-03-06 14:48:43 +00:00
ioat dmaengine: ioatdma: use pci_dev_id() to simplify the code 2023-08-21 18:39:25 +05:30
lgm dmaengine: lgm: Use builtin_platform_driver macro to simplify the code 2023-08-21 11:13:09 +05:30
mediatek dmaengine: mediatek: Fix deadlock caused by synchronize_irq() 2023-10-04 19:26:36 +05:30
ppc4xx dmaengine: Explicitly include correct DT includes 2023-08-01 23:51:27 +05:30
ptdma dmaengine: ptdma: use consistent DMA masks 2024-03-06 14:48:40 +00:00
qcom dmaengine: Explicitly include correct DT includes 2023-08-01 23:51:27 +05:30
sf-pdma dmaengine: sf-pdma: pdma_desc memory leak fix 2023-02-16 18:45:48 +05:30
sh dmaengine: shdma: increase size of 'dev_id' 2024-03-01 13:34:48 +01:00
ti dmaengine: ti: edma: Add some null pointer checks to the edma_probe 2024-03-01 13:34:50 +01:00
xilinx dmaengine updates for v6.6 2023-09-03 10:49:42 -07:00
acpi-dma.c dmaengine: acpi: Check for errors from acpi_register_gsi() separately 2021-08-06 21:48:11 +05:30
altera-msgdma.c dmaengine: altera-msgdma: Fixed some inconsistent function name descriptions 2022-07-06 22:00:06 +05:30
amba-pl08x.c dmaengine: pl08x: Fix double word 2022-09-29 12:24:16 +05:30
apple-admac.c dmaengine: apple-admac: Keep upper bits of REG_BUS_WIDTH 2024-03-01 13:34:47 +01:00
at_hdmac.c dmaengine: Explicitly include correct DT includes 2023-08-01 23:51:27 +05:30
at_xdmac.c dmaengine: at_xdmac: fix potential Oops in at_xdmac_prep_interleaved() 2023-05-19 16:54:04 +05:30
bcm-sba-raid.c dmaengine: Explicitly include correct DT includes 2023-08-01 23:51:27 +05:30
bcm2835-dma.c dmaengine: drivers: Use devm_platform_ioremap_resource() 2023-01-18 22:16:47 +05:30
dma-axi-dmac.c dmaengine: axi-dmac: Don't set chancnt 2023-05-24 12:24:32 +05:30
dma-jz4780.c dmaengine: Explicitly include correct DT includes 2023-08-01 23:51:27 +05:30
dmaengine.c dmaengine: fix NULL pointer in channel unregistration function 2024-01-31 16:18:47 -08:00
dmaengine.h dmaengine: dmaengine_desc_callback_valid(): Check for callback_result 2021-10-25 09:42:56 +05:30
dmatest.c treewide: use get_random_bytes() when possible 2022-10-11 17:42:58 -06:00
ep93xx_dma.c dmaengine: ep93xx: Use struct_size() 2023-08-02 00:02:51 +05:30
fsl-edma-common.c dmaengine: fsl-edma: correct calculation of 'nbytes' in multi-fifo scenario 2024-03-06 14:48:41 +00:00
fsl-edma-common.h dmaengine: fsl-dma: fix DMA error when enabling sg if 'DONE' bit is set 2023-09-28 16:50:34 +05:30
fsl-edma-main.c dmaengine: fsl-edma: fix eDMAv4 channel allocation issue 2024-01-31 16:18:47 -08:00
fsl-qdma.c dmaengine: fsl-qdma: init irq after reg initialization 2024-03-06 14:48:41 +00:00
fsl_raid.c dmaengine: Explicitly include correct DT includes 2023-08-01 23:51:27 +05:30
fsl_raid.h dmaengine: Driver support for FSL RaidEngine device. 2015-04-02 16:10:27 +05:30
fsldma.c dmaengine: Explicitly include correct DT includes 2023-08-01 23:51:27 +05:30
fsldma.h fsldma: fix very broken 32-bit ppc ioread64 functionality 2020-08-29 13:50:56 -07:00
hisi_dma.c dmaengine: hisilicon: Dump regs to debugfs 2022-09-04 22:42:35 +05:30
idma64.c dmaengine: idma64: Update bytes_transferred field 2023-02-16 18:45:48 +05:30
idma64.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
img-mdc-dma.c dmaengine: Explicitly include correct DT includes 2023-08-01 23:51:27 +05:30
imx-dma.c dmaengine: Explicitly include correct DT includes 2023-08-01 23:51:27 +05:30
imx-sdma.c dmaengine: Explicitly include correct DT includes 2023-08-01 23:51:27 +05:30
k3dma.c dmaengine: k3dma: use the correct HiSilicon copyright 2021-04-12 17:14:53 +05:30
Kconfig dmaengine updates for v6.6 2023-09-03 10:49:42 -07:00
lpc18xx-dmamux.c dmaengine: Explicitly include correct DT includes 2023-08-01 23:51:27 +05:30
Makefile dmaengine: fsl-edma: clean up EXPORT_SYMBOL_GPL in fsl-edma-common.c 2023-08-22 20:11:02 +05:30
mcf-edma-main.c dmaengine updates for v6.6 2023-09-03 10:49:42 -07:00
milbeaut-hdmac.c dmaengine: milbeaut-hdmac: Prefer kcalloc over open coded arithmetic 2021-10-25 12:12:13 +05:30
milbeaut-xdmac.c dmaengine: milbeaut-xdmac: Fix a resource leak in the error handling path of the probe function 2020-12-29 10:08:00 +05:30
mmp_pdma.c dmaengine: drivers: Use devm_platform_ioremap_resource() 2023-01-18 22:16:47 +05:30
mmp_tdma.c dmaengine updates for v6.3 2023-02-24 17:18:54 -08:00
moxart-dma.c dmaengine: drivers: Use devm_platform_ioremap_resource() 2023-01-18 22:16:47 +05:30
mpc512x_dma.c dmaengine: Explicitly include correct DT includes 2023-08-01 23:51:27 +05:30
mv_xor.c dmaengine: mv_xor: drop of_match_ptr from of_device_id table 2020-11-24 23:02:20 +05:30
mv_xor.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 288 2019-06-05 17:36:37 +02:00
mv_xor_v2.c dmaengine updates for v6.4 2023-05-03 11:11:56 -07:00
mxs-dma.c dmaengine: Explicitly include correct DT includes 2023-08-01 23:51:27 +05:30
nbpfaxi.c dmaengine: Explicitly include correct DT includes 2023-08-01 23:51:27 +05:30
of-dma.c dmaengine: Use of_property_present() for testing DT property presence 2023-03-17 23:11:42 +05:30
owl-dma.c dmaengine updates for v6.6 2023-09-03 10:49:42 -07:00
pch_dma.c dmaengine: pch_dma: Remove usage of the deprecated "pci-dma-compat.h" API 2022-01-08 22:16:44 +05:30
pl330.c dmaengine: pl330: Return DMA_PAUSED when transaction is paused 2023-08-07 00:01:41 +05:30
plx_dma.c dmaengine: plx_dma: Don't set chancnt 2023-05-24 12:24:32 +05:30
pxa_dma.c dmaengine: pxa_dma: Remove an erroneous BUG_ON() in pxad_free_desc() 2023-11-20 11:59:26 +01:00
sa11x0-dma.c dmaengine: sa11x0: Mark PM functions as __maybe_unused 2021-10-26 10:55:07 +05:30
sprd-dma.c dmaengine: Explicitly include correct DT includes 2023-08-01 23:51:27 +05:30
st_fdma.c dmaengine: st_fdma: fix MODULE_ALIAS 2021-12-13 13:18:48 +05:30
st_fdma.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
ste_dma40.c dmaengine: ste_dma40: Fix PM disable depth imbalance in d40_probe 2023-10-09 10:56:51 +05:30
ste_dma40.h dmaengine: ste_dma40: Remove platform data 2023-05-16 23:00:19 +05:30
ste_dma40_ll.c dmaengine: ste_dma40: Remove platform data 2023-05-16 23:00:19 +05:30
ste_dma40_ll.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 194 2019-05-30 11:29:22 -07:00
stm32-dma.c dmaengine: stm32-dma: avoid bitfield overflow assertion 2023-12-20 17:02:02 +01:00
stm32-dmamux.c dmaengine: Explicitly include correct DT includes 2023-08-01 23:51:27 +05:30
stm32-mdma.c dmaengine: stm32-mdma: correct desc prep when channel running 2023-11-28 17:20:05 +00:00
sun4i-dma.c dmaengine: drivers: Use devm_platform_ioremap_resource() 2023-01-18 22:16:47 +05:30
sun6i-dma.c dmaengine: Explicitly include correct DT includes 2023-08-01 23:51:27 +05:30
tegra20-apb-dma.c dmaengine: Explicitly include correct DT includes 2023-08-01 23:51:27 +05:30
tegra186-gpc-dma.c dmaengine: Explicitly include correct DT includes 2023-08-01 23:51:27 +05:30
tegra210-adma.c dmaengine: Explicitly include correct DT includes 2023-08-01 23:51:27 +05:30
timb_dma.c dmaengine: timb_dma: convert tasklets to use new tasklet_setup() API 2020-09-18 12:19:07 +05:30
TODO dmaengine: dw: don't perform DMA when dmaengine_submit is called 2014-07-15 22:14:30 +05:30
txx9dmac.c dmaengine: txx9dmac: convert tasklets to use new tasklet_setup() API 2020-09-18 12:19:07 +05:30
txx9dmac.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
uniphier-mdmac.c dmaengine: uniphier-mdmac: replace zero-length array with flexible-array member 2020-02-13 20:15:57 +05:30
uniphier-xdmac.c dmaengine: uniphier-xdmac: Fix type of address variables 2022-01-03 17:49:37 +05:30
virt-dma.c dmaengine: virt-dma: convert tasklets to use new tasklet_setup() API 2020-09-18 12:19:07 +05:30
virt-dma.h dmaengine: virt-dma: Add missing locking around list operations 2019-12-26 10:04:18 +05:30
xgene-dma.c dmaengine: Explicitly include correct DT includes 2023-08-01 23:51:27 +05:30